Are SourceSafe password scheme and database rights a joke and Microsoft doesn “get” security?
No. Microsoft does not see SourceSafe password scheme and the SourceSafe user rights as security measures. The VSS built-in mechanisms will only prevent for instance a user to delete a file by mistake, or to checkin by mistake newer versions of a file in parts of the tree that were locked down. They will not prevent a determined hacker to view or modify the database files. Microsoft recommends securing the SourceSafe database by using NTFS access lists and file share permissions, and restricting the database access only to those Windows users who really need access (see below). Should I worry that someone could reset the SourceSafe Admin password? No. Someone who wants to read the files stored in a VSS database doesn’t have know, reset or recover a password. If such user has access to the database share, he can simply view the content of all the files in the database by looking in the physical files like WRTBAAA.A and .B from the data subfolder. And he can easily reconstruct the file n
